What’s new in Hasura GraphQL Engine v2.50.1
The patch release v2.50.1 (published 18 Aug 2026) focuses on privacy, reliability, and security improvements.
Log redaction flags
Three new server flags are now available (default false) to redact sensitive data from delivery logs:
--redact-event-trigger-logs(HASURA_GRAPHQL_REDACT_EVENT_TRIGGER_LOGS)--redact-scheduled-trigger-logs(HASURA_GRAPHQL_REDACT_SCHEDULED_TRIGGER_LOGS)--redact-action-handler-logs(HASURA_GRAPHQL_REDACT_ACTION_HANDLER_LOGS)
When enabled, request bodies, session variables, and webhook responses are emitted as JSON null instead of their raw values.
Improved @cached directive handling
Queries that use the @cached directive no longer return a 400 not‑supported error when the Redis cache is unavailable. The engine now falls back to executing the query without caching, matching the documented “fail‑open” behavior used for rate‑limiting.
Console SSO regression fixed (Enterprise/Cloud only)
A migration to jwt-decode@4 in v2.50.0 broke SSO login in the Console (the UI hung on “Validating…”). The release restores the expected token shape ({ header, payload }), allowing SSO users and the API Explorer JWT analyzer to work again.
Data Connector security updates (Enterprise/Cloud only)
The super‑connector’s Quarkus platform was upgraded, pulling newer micrometer-core, netty, and vertx-core versions. This addresses CVE‑2026‑40983 and CVE‑2026‑40984 (high‑severity DoS vulnerabilities) as well as CVE‑2026‑50559.
Overall impact
These changes enhance privacy controls, increase resilience when caching services fail, restore SSO functionality for enterprise users, and mitigate critical denial‑of‑service risks.